Security Policy

Only the latest main receives security fixes.

To report a vulnerability, use GitHub's private "Report a vulnerability" form on this repository rather than opening a public issue.

Security fixes made upstream in Boring Notch are tracked in docs/UPSTREAM-SYNC.md and cherry-picked as needed.